Password complexity and max failures attempts

[Brandon Sauvenière (Brandysve)]

Hello,

Is it possible to manage the password complexity when user create a password? (ex : min 14 chars with uppercase, lowercase, numbers and special chars).

It there a maximal failures attempts? We're planning to use dspace for our target with +/- 15000 users. We want to be sure that it is safe against attacks.

It is external users so we don't use LDAP, shibboleth, etc...

Thank you :)

[Tim Donohue]

Hi,

In DSpace 7, you can manage password complexity rules in a configuration.  It's controlled by a regex pattern defined here:

https://github.com/DSpace/DSpace/blob/main/dspace/config/modules/authentication-password.cfg#L51

Some examples of different patterns are given in the comments of that config file.

At this time though there is no "maximum failure" attempt rules for the default password system.  I do agree this would be useful enhancement though... so, you are welcome to create a bug ticket regarding this & we'll see if we can locate a volunteer interested in implementing it. https://github.com/DSpace/DSpace/issues

Tim